I have a first pulldown "eventDescription". Based on the selected event description I need to populate additional pulldowns with related fields. How we can achieve this with sideview.
Refering to the question http://splunk-base.splunk.com/answers/58060/second-dropdown-is-not-getting-populated
How we can do this with sideview app. As I am using sideview pulldowns. I went to sideview documentation but not able to find it. Please guide.
Thanks in advance.
In english we set up a Search module, and then the Pulldown module downstream will use that dispatched search to get its results and populate itself. Then the selection from that first Pulldown is just plugged right into a second Search module (note $group$), there's a second Pulldown module that will use the second search to populate itself. Then finally, downstream from the second Pulldown, the selection from both Pulldowns are plugged right into a third Search module (note $group$ $series$). And then we finally render the stats for the selected group and series in a Table module.
For more advanced users that don't want to spend one whole search to render each Pulldown, with the Sideview Pulldown module you can rig up both Pulldowns to work from a single search,
index=_internal source="*metrics.log" group="per_*_thruput" | stats count by group series
and then use the Pulldown's postProcess param to slice out just the group values, or just the series values, as desired for each Pulldown. Check out the docs for more details about postProcess.
Note: this example will only work with latest Sideview Utils - the valueField param replaced the searchFieldsToDisplay param as of 2.0, and the Table module is new in Sidevuew Utils 2.2